How can I recover moved jpg files

On my ubuntu system I ran a command and moved all my jpg files to a single file by mistake

src_dir=$1
echo "src_dir: $src_dir"

for f in $src_dir/*; do
    if [ -f $f ]; then
        new_dir=$(date -r $f +"%b_%Y")
        if [ ! -d $new_dir ]; then
            mkdir $new_dir
        fi
        echo "File: $f "
        mv $f $src_dir/$new_dir
    fi
done

I tried recovering my jpg files using recoverJpeg and scalpel. These tools were able to recover the images which I deleted long back. However I did not recover any image which got moved using mv command.

I understand its a long shot but is there any way to get back the images?

Asked By: Daemon

||

If recoverJpeg and scalpel can’t find them, I’d say no.

However, once upon a time, those files existed simultaneously, so their data occupied different places in the disk. Moving files inside the same mount point should be nothing more that removing the old inode on the source folder, and creating a new inode on the destination folder, pointing to the same disk sectors that hold the data. That’s why it’s almost instantaneous to move a huge file within the same mount point, no new data is written, only reused. So, in theory, mving your files might (should?) not have erased the data. However when you mv a new file to a pre-existing file (i.e. dropping the first file’s inode and creating a new one with the same name but pointing at another part of the disk), the sectors that hold the data of the first file are marked as free, and might be overwritten. (Note that all this might not be entirely true, depending on your filesystem, but in my experience it usually is).

So when stuff like this happens it is crucial to mount the filesystem read-only, before using the forensic tools. If they can’t find anything, maybe the data is really gone. If you have room for it, creating an image of the filesystem with dd might also help, as it "crystallizes" things for future forensic work.

Relatedly, adding these three lines to my .profile has saved my ass on many many occasions:

alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
Answered By: Zé Loff
Categories: Answers Tags: , , ,
Answers are sorted by their score. The answer accepted by the question owner as the best is marked with
at the top-right corner.